From f90e8b84b203151e4edb190a4bc51c65b1267223 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sun, 28 Oct 2018 00:08:35 +0200
Subject: [PATCH] fixed a bug where search returned internal pages to
 unauthenticated users

---
 pkg/db/page.go        | 13 +++++++++++++
 pkg/server/handler.go | 12 +++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/pkg/db/page.go b/pkg/db/page.go
index c7dc552..388de0b 100644
--- a/pkg/db/page.go
+++ b/pkg/db/page.go
@@ -38,6 +38,19 @@ func (db *DB) GetAllPages(username string) (pages core.Pages) {
 	return
 }
 
+func (db *DB) ValidatePage(st, username string) bool {
+	p := db.cache.Get(st)
+	if p == nil {
+		p, err := db.getPage(st, username)
+		if err != nil {
+			return false
+		}
+		db.cache.Add(st, p)
+		return true
+	}
+	return core.ReadPerm(username, p)
+}
+
 func (db *DB) GetPage(section, title, username string) (p *core.Page, err error) {
 	st := render.StoreTitle(section, title)
 	p = db.cache.Get(st)
diff --git a/pkg/server/handler.go b/pkg/server/handler.go
index 7930dda..0bd872d 100644
--- a/pkg/server/handler.go
+++ b/pkg/server/handler.go
@@ -181,7 +181,17 @@ func searchHandler(ctx *Context) {
 			ctx.Error(err)
 			return
 		}
-		ctx.Data.Data = res
+		user := ctx.User()
+		r := make([]core.Result, len(res))
+		i := 0
+		for _, v := range res {
+			if ctx.Srv.DB.ValidatePage(v.StoreTitle, user) {
+				r[i] = v
+				i++
+			}
+		}
+
+		ctx.Data.Data = r[:i]
 		ctx.Data.Search = search
 		ctx.Exec()
 	}